LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint

Description

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint.

An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records.

The endpoint may return an HTTP 500 response after the request, but the database write has already occurred. The resulting attacker-controlled menu entry can later be observed by a superadministrator in the menu-entry list.

Vulnerability

Root cause

1. The controller constructor sets the only shared authorization gate for the controller to settings:read:

2. The legacy create() action performs no additional authorization check:

3. The intended creation and edit form submits to the stricter update handler:

4. The update() handler enforces the missing authorization boundary:

5. The same handler attempts to protect main administrative menu entries from non-superadministrators:

6. The global permission model defines settings:create as disabled, leaving settings:update as the intended modification permission for this area:

7. SurveymenuEntries::save() drops the return value from parent::save():

   Because no boolean is returned, the caller sees a falsey value even after a successful insert. create() then falls through to $this->render('create', ...), which can produce the observed HTTP 500, but this happens after the committed database operation.

Source-to-sink path

1. Source: an authenticated low-privileged user controls SurveymenuEntries[...] parameters in a POST request.

2. Controller gate: SurveymenuEntryController::__construct() accepts the request because the user has settings:read.

3. Vulnerable action: create() accepts $_POST['SurveymenuEntries'] directly.

4. Missing check: create() does not enforce settings:update, superadmin, or the main-menu restriction used in the intended workflow.

5. Persistence: SurveymenuEntries::save() inserts the new row in {{surveymenu_entries}}.

6. Post-write error: the missing return value causes the action to continue into an invalid render path, returning HTTP 500 without rolling back the insert.

7. Impact sink: the attacker-created menu entry is stored in the administrative menu-entry configuration and can be verified by a superadministrator.

Impact

An authenticated user with only read access to global settings can perform an unauthorized administrative configuration change by creating survey menu entries. This violates LimeSurvey's permission model, where read-only settings access should not allow modification of global settings or menu configuration.

Potential impact includes:

• Unauthorized modification of administrative navigation records.

• Creation of misleading or disruptive menu entries in a trusted administrative interface.

• Placement of attacker-controlled links or labels that may facilitate phishing or operator workflow disruption.

• Increased impact when chained with a separate stored XSS or trusted-link abuse primitive.

The attacker must already have an authenticated LimeSurvey account with settings:read, so this is a privileged but non-superadministrator authorization bypass.

PoC

Preconditions

• LimeSurvey Community Edition 7.0.5+260623.

• A low-privileged authenticated user with global settings:read.

• The same user must not have global settings:update.

• The same user must not have superadmin.

• A valid session cookie and CSRF token for that user.

• A superadministrator account to verify menu entries assigned to main administrative menu IDs.

Reproduction

1. Log in as a user that has only the global settings:read permission.

2. Navigate to:

   Configuration > Survey menus > Survey menu entries > New menu entry

   Configuration > Survey menus > Survey menu entries > New menu entry

   Configuration > Survey menus > Survey menu entries > New menu entry

   Configuration > Survey menus > Survey menu entries > New menu entry

3. Fill in the form with valid values and intercept the request.

4. The normal frontend sends new entries to the intended update route:

   /index.php/admin/menuentries/sa/update/id

   /index.php/admin/menuentries/sa/update/id

   /index.php/admin/menuentries/sa/update/id

   /index.php/admin/menuentries/sa/update/id

5. Change the request path to the legacy creation endpoint:

   /index.php/admin/menuentries/sa/create

   /index.php/admin/menuentries/sa/create

   /index.php/admin/menuentries/sa/create

   /index.php/admin/menuentries/sa/create

6. Set SurveymenuEntries[menu_id] to a target menu ID, including a main administrative menu ID such as 1 or 2.

7. Send the modified authenticated POST request:

   POST /index.php/admin/menuentries/sa/create HTTP/1.1
   Host: 127.0.0.1:8081
   Content-Type: application/x-www-form-urlencoded
   Cookie: <authenticated-session-cookie>
   
   YII_CSRF_TOKEN=<valid-csrf-token>
   
   

   POST /index.php/admin/menuentries/sa/create HTTP/1.1
   Host: 127.0.0.1:8081
   Content-Type: application/x-www-form-urlencoded
   Cookie: <authenticated-session-cookie>
   
   YII_CSRF_TOKEN=<valid-csrf-token>
   
   

   POST /index.php/admin/menuentries/sa/create HTTP/1.1
   Host: 127.0.0.1:8081
   Content-Type: application/x-www-form-urlencoded
   Cookie: <authenticated-session-cookie>
   
   YII_CSRF_TOKEN=<valid-csrf-token>
   
   

   POST /index.php/admin/menuentries/sa/create HTTP/1.1
   Host: 127.0.0.1:8081
   Content-Type: application/x-www-form-urlencoded
   Cookie: <authenticated-session-cookie>
   
   YII_CSRF_TOKEN=<valid-csrf-token>
   
   

8. Observe that the server may return:

   HTTP/1.1 500 Internal Server Error

   HTTP/1.1 500 Internal Server Error

   HTTP/1.1 500 Internal Server Error

   HTTP/1.1 500 Internal Server Error

9. Log in as a superadministrator and navigate to:

   Configuration > Survey menus > Survey menu entries

   Configuration > Survey menus > Survey menu entries

   Configuration > Survey menus > Survey menu entries

   Configuration > Survey menus > Survey menu entries

10. Verify that the unauthorized menu entry is present despite being created by a user with only settings:read.

Expected result:

• The application should reject the request before persistence because the user lacks settings:update and superadmin.

Observed vulnerable result:

• The menu entry is persisted.

• The HTTP 500 occurs after the database write and does not prevent the unauthorized change.

Evidence of Exploitation

• Video of exploitation:

  

  
  

• Static evidence:

  

Our security policy

We have reserved the ID CVE-2026-65931 to refer to this issue from now on.

Disclosure policy

System Information

• LimeSurvey

• Version: 7.0.5

• Operating System: Any

References

• GitHub Repository: https://github.com/LimeSurvey/LimeSurvey/

• Security: https://github.com/LimeSurvey/LimeSurvey/security

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Miguel Gomez from Fluid Attacks' Offensive Team.